CVE-2021-37331

Laravel Booking System Booking Core 2.0 is vulnerable to Incorrect Access Control. On the Verifications page, after uploading an ID Card or Trade License and viewing it, ID Cards and Trade Licenses of other vendors/users can be viewed by changing the URL.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

0.97% chance of exploitation in the next 30 days, 59th percentile

Published

2021-10-04

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://www.navidkagalwalla.com/booking-core-vulnerabilities

References

• CVE Record
• NVD entry

Related

• CVE-2021-37330
• CVE-2021-37333
• CVE-2021-37322
• CVE-2021-3734
• CVE-2021-37317
• CVE-2021-37343